During the Diffie‑Hellman key exchange implemented in OpenSSL, a vulnerable implementation of EVP_PKEY_derive_set_peer() does not properly verify that the peer’s group parameters are consistent with the local key. An attacker can supply a synthetic X9.42 key that uses the victim’s p and g values but replaces the q parameter with a small prime that divides the co‑factor and supplies a public value Y of that small order. Because the subgroup membership test uses the peer’s own q instead of the local q, this malicious key passes all validity checks. The resulting shared secret has only a few possible values, allowing the attacker to recover the victim’s private DH key after a few exchanges. If the attacker repeats this process for each small subgroup, the full private key can be reconstructed using the Chinese remainder theorem.

All OpenSSL FIPS modules up to and including 4.0, 3.6, 3.5, 3.4, and 3.0 are affected. Systems that deploy X9.42 DHX static keys – commonly found in certificate‑management protocols and some government or enterprise applications – are directly exposed.

No EPSS score is available and the vulnerability is not listed in the CISA KEV catalog, but the issue is specific to a narrow set of deployments that use static DHX keys with custom domain parameters. The exploit requires a malicious peer during the key exchange and the attacker must supply precisely crafted subgroup parameters. While the risk is low for general internet traffic, any environment that performs manual or automated X9.42 Diffie‑Hellman key agreement could be compromised. The CVSS score is 3.7, indicating a low‑severity risk, yet the potential outcome is total loss of confidentiality for the private key if the vulnerability is leveraged.